Learning Web Pentesting With DVWA Part 1: Installation

In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa

It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:

login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.

Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.

Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:

From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.

Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.

We will explain what is going on here in the next article.


References:-
1. DVWA Official Website: http://www.dvwa.co.uk/

Related links

1. Pentest Tools Website Vulnerability
2. Hack And Tools
3. Pentest Tools For Windows
4. Hacker Tools
5. Hacking Tools For Windows 7
6. Pentest Tools Windows
7. Hack Website Online Tool
8. Tools 4 Hack
9. Pentest Tools
10. Hack Tools Online
11. Hacking App
12. Hack Tools For Games
13. What Is Hacking Tools
14. Best Pentesting Tools 2018
15. Hacking Tools For Windows
16. Hackers Toolbox
17. Hacking Tools For Windows
18. Hacker Tools For Pc
19. Hacking Tools And Software
20. Hacker Tools For Ios
21. Hacking Tools For Windows 7
22. Hacking Tools Name
23. Hack Tool Apk No Root
24. Pentest Tools For Ubuntu
25. Hacker Hardware Tools
26. Pentest Box Tools Download
27. Hacking Tools Free Download
28. Tools For Hacker
29. Hacking Tools For Windows
30. Tools 4 Hack
31. Hacking Tools Hardware
32. Github Hacking Tools
33. Hacker Tools Apk Download
34. Hacker Tools Apk
35. Hacking Tools Windows
36. Hack Tools Online
37. Pentest Tools Subdomain
38. Pentest Tools
39. Ethical Hacker Tools
40. Hacker Tools 2020
41. Hack Tools 2019
42. Underground Hacker Sites
43. Hacking Tools Usb
44. Best Pentesting Tools 2018
45. Hacker Tool Kit
46. Hacker Tools Linux
47. Install Pentest Tools Ubuntu
48. Pentest Tools Tcp Port Scanner
49. Hacking Tools For Windows
50. Hacking Tools Github
51. Android Hack Tools Github
52. Hacker Tools 2020
53. Hacking Tools Mac
54. Hacking Tools Name
55. Pentest Tools Windows
56. Hackers Toolbox
57. Hacking Tools Mac
58. Hack Website Online Tool
59. Hacking Tools Github
60. Pentest Tools Tcp Port Scanner
61. Pentest Tools Website
62. Android Hack Tools Github
63. Hack App
64. Hacker Security Tools
65. Pentest Tools Free
66. Hacker Techniques Tools And Incident Handling
67. Best Pentesting Tools 2018
68. Hacker Hardware Tools
69. Kik Hack Tools
70. Hacker Tools Free
71. Hack Tools 2019
72. Hack Tools Pc
73. Install Pentest Tools Ubuntu
74. Hacker Search Tools
75. Nsa Hack Tools Download